Gmail is listed under Google’s BAA for Google Workspace customers, and an administrator must review and accept the BAA in the Admin console before any PHI is used. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Google Workspace accounts with the BAA accepted; Google’s pages do not list qualifying editions | Covered |
What the BAA leaves out
- Third-party applications and add-ons
- Additional Google Services outside the covered list
- Gemini in Google Chrome
- Gemini app when enabled as an Additional Product rather than a Core Service
- Pre-GA offerings unless they say otherwise
- PHI must not be given to Google technical support
How to get the BAA
An administrator reviews and accepts it electronically in the Google Admin console.
What the vendor says to do
- Sign in as an administrator and accept the BAA under Account settings, then Legal and compliance
- Separate PHI users with organizational units and turn off non-core services for them
- Set DLP policies that scan email for PHI identifiers
- Use Bcc rather than To for mailing lists
- Review third-party app access before sharing PHI
Proof from the vendor
- HIPAA compliance on Google Cloud and Google WorkspaceGmail is listed as included in the BAA; Gemini in Chrome excluded (Workspace section dated 2026-10-28)
- HIPAA Compliance with Google Workspace and Cloud IdentityAdmin console steps; Gemini features in Gmail covered; third-party and Additional Services not covered
- Google Workspace and Cloud Identity HIPAA Implementation Guide (September 2025)Gmail configuration; Gemini app and pre-GA limits
- Google Workspace HIPAA Business Associate AmendmentBAA needs an existing Services Agreement; effective on electronic acceptance
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.